The Open Source Definition and licenses that help implement
national laws
by Seth David Schoen
Q. Does the Apple Public Source License qualify as an
Open Source license?Yes, the Open Source Initiative has determined that the Apple
Public Source License is conformant to the “Open Source
Definition:” http://www.opensource.org/osd.html.
The Apple
Public Source License (APSL), version 1.0, says:
13.1 Export Law Assurances. You may not use or
otherwise export or re-export the Original Code except as
authorized by United States law and the laws of the jurisdiction in
which the Original Code was obtained. In particular, but without
limitation, the Original Code may not be exported or re-exported
(a) into (or to a national or resident of) any U.S. embargoed
country or (b) to anyone on the U.S. Treasury Department’s list of
Specially Designated Nationals or the U.S. Department of Commerce’s
Table of Denial Orders. By using the Original Code, You represent
and warrant that You are not located in, under control of, or a
national or resident of any such country or on any such
list.
The Open Source
Definition (OSD), version 1.0, says:
5. No Discrimination Against Persons or Groups.
The license must not discriminate against any person or group of
persons.
I can’t understand how all three of these things can be true at the
same time. The APSL requires licensees to
warrant and represent that [they] are not located in,
under control of, or a national or resident of any such country or
any such list
— but, since many persons and groups of persons cannot
(truthfully) do that, the APSL discriminates against all of them.
Therefore, as I see it, the APSL is not an Open Source license and
the Open Source Initiative
(OSI) should reconsider its decision about the current version of
the APSL, asking Apple to fix this problem with its license.
I have had many discussions with people over the OSD and
national export controls. I would be curious to learn the OSI’s
position on this subject.
My position is this:
“Must not discriminate” in the OSD should really mean “must not
discriminate”. Incorporating provisions of legislation which
discriminates against any person or group of persons into a license
means that the license necessarily itself discriminates against a
person or group of persons, and is therefore not an Open
Source license. The fact that discrimination is motivated by a
government regulation or recommendation does not mean that it is
not discrimination, and therefore does not mean that it ought to be
sanctioned by the OSI. The fact that the license is prima
facie discriminatory is readily acknowledged by Apple:
Q: Are there restrictions on the international use of
the source code?Yes. Export control laws may apply to certain portions of the
source code and must be complied with.
“[M]ust be complied with”? Quo warranto? Certainly these
laws “must be complied with” according to the Bureau of Export Administration
(BXA), but we are also given to believe that these laws “must be
complied with” according to Apple!
Further, since Open Source licenses do not necessarily
require that a work be distributed to every person who requests it, the original
distributor of a piece of Open Source software is free to follow
local law by refraining from distributing the software directly to
persons who are forbidden to receive it. However, if the original
distributor attempts to use the license itself to prevent third
parties from distributing the software as they see fit (whether or
not such distribution is allowed by a particular country’s law),
the distributor is thus assisting in enforcing discriminatory laws,
and thereby discriminating.
This particular export clause is even worse than most, because
it requires anyone obtaining the software to abide by United States
law, even people who would ordinarily not be subject to U.S. law.
This practice and the practice of adding specific restrictions on
the use of the software once a copy has already been obtained may
also violate OSD 7:
7. Distribution of License.
The rights attached to the program must apply to all to whom the
program is redistributed without the need for execution of an
additional license by those parties.
Since the APSL makes users implicitly “represent and warrant”
specific facts about their personal status even after they have
received a copy of APSL-covered software, its requirements appear
to run afoul of both OSD 5 and OSD 7. How is it possible for
“rights attached to the program [to] apply to all to whom the
program is redistributed” (emphasis mine) if users in certain
countries are prohibited in advance from using the software at all?
There is, of course, always a difference between personally
abiding by a law and personally assisting a government in enforcing
it against others. When governments make laws which discriminate
against particular persons or groups, Open Source authors can
certainly follow those laws, but if they decide to help governments
enforce those laws by writing them directly into their
licenses, they are no longer in compliance with the letter or the
spirit of the OSD.
In general, if export laws are discriminatory, and Open Source
licenses must be non-discriminatory, then Open Source licenses must
oppose or be neutral toward export laws, but should not support
them.
I’ve managed to persuade other people that they needed to drop
export control language from their public license (which aims at
Open Source compliance) by presenting a version of the present
argument, so I know that this interpretation of the OSD is at least
plausible to someone other than myself.
“May” versus “must”
The OSD says that a license isn’t allowed to “restrict any party
from selling or giving away” the software. This idea was earlier
made explicit in the GNU General Public License (GPL), which says
that you have to allow “all third parties” to obtain all the rights
that you have. Note that this doesn’t say that you must give a
copy of the software to anyone who asks! It merely says that
you may give a copy to anyone — and that you must not add
any restrictions which prevent other people from doing so.
Someone who writes GPL-covered software isn’t required to
violate local law by giving the software to people who aren’t
allowed to receive it. On the other hand, the GPL doesn’t allow
software authors to add additional constraints or obligations on
recipients of the software. Thus, receipients of the software may
distribute it to whomever they choose, regardless of the original
governing law(s) of the circumstances in which the software was
originally created or distributed.
The OSD seems to pick up on this implicitly in paragraphs 1, 3,
5, 6, and 7. As I read those paragraphs, there is no obligation on
a software distributor under an Open Source license to violate the
law by distributing software illegally. Equally importantly,
however, the OSD will not allow a software distributor under an
Open Source license to place conditions on others which prevent
them from making their own choices.
Thus, I conclude that the OSD does not require Apple to violate
United States export laws, but does require it to remain neutral
toward others’ violations of those laws.
What Apple should do
Apple should remove paragraph 13.1 from the APSL entirely. On the
web page where users download the software, Apple should, if it
believes this is necessary, have an export status check, which asks
users to verify their legal eligibility to receive the software.
This change guarantees that Apple itself will not take
legal action for copyright infringement or breach of contract
against people in any country who ultimately receive, distribute,
or use APSL-covered Original Code in violation of US law.
Of course, Apple is under no obligation to do this; however,
this change would help bring the APSL into compliance with the OSD,
which is intended to express an approximate summary of some of the
values of the free software community. (Recall that the OSD is
descended from the Debian Free Software Guidelines, which represent
a set of ethical suggestions and value judgments rather than legal
criteria.)
Questions and clarifications about this position
Deirdre Saoirse said:
As for the export laws, it says “except as authorized
by United States Law.” I’m not sure they can change that as it is
an implicit part of ANY software developed in the US.
🙁
I disagree, because of what I was trying to explain above about
helping enforce discriminatory laws. Consider the
difference between these two cases:
Case 1: A license does not specifically require compliance with
a law.
When someone violates the law, this means:
- A violation of the law, if the violation happens within the
jurisdiction that created the law (or if the law is
extraterritorial).
Case 2: A license specifically requires compliance with a
law.
When someone violates the law, this means:
- A violation of the law, if the violation happens within the
jurisdiction that created the law (or if the law is
extraterritorial).- Also a violation of copyright or a breach of contract,
depending on whether software licenses are construed as existing
inside of copyright law or contract law.
There are at least two classes of people whose behavior would
therefore be affected by any license which requires compliance with
a law:
- People who respect the license terms or the author’s copyright,
but do not respect the law (e.g. people who believe the law is
unjust and intend to disobey it). - People who respect the license terms or the author’s copyright,
but are outside of the jurisdiction of the law (e.g. people who
live in other countries).
From a legal point of view, people who are in some jurisdiction are
always subject to its laws, whatever a software license does or
does not say. But, by including politically-motivated restrictions
within the text of a license itself, the software author codifies
the policy of one jurisdiction at a particular time as a permanent
part of the license for all users, anywhere in the world, forever.
If an Orthodox Jew wanted to put a clause into a license that
said that the software must not be used on Saturday, how could you
answer? He would certainly say that he was just alluding to the law
which was already binding on all Jews anyway. One good way to
answer might be that (1) that law does not claim to bind everyone;
(2) not everyone that law claims to bind actually intends to follow
it; and (3) mostly importantly, a free license should not
incorporate extraneous material and restrictions, since this takes
away from users’ ability to make these decisions for
themselves.
It’s not software authors’ job to help governments enforce their
laws, and, if they do so to the detriment of software users’
freedom to use, modify, copy, or distribute software, I think the
existing OSD already provides reason enough to say that the result
is not Open Source.
Since not every piece of software in the US is released with a
license prohibiting the software from being used for illegal
purposes, it’s pretty clearly not a legal requirement to do so. (A
requirement that software authors actually exhort people to follow
the law would probably not be allowed in the US because of
“compelled speech” interpretations of the First Amendment. If such
a requirement were actually in place, however, it would simply
prevent US developers from writing Open Source software.)
It should not be assumed that this line of thought applies only
to export laws. In fact, there are a great many ways in which
governments may attempt to regulate software in the future. It is
important that software developers not be forced to pass on local
conditions for the use of their code to the entire world via the
terms of their software licenses.
A further < a href=”https://www.linuxtoday.com/”>discussion
on this subject with someone who read this document is available.
On request, I’ll be glad to post others’ comments or questions,
with or without my answers.